Privacy & Cookies
Last updated 28 September 2026
Who is responsible
Open-Elevation is responsible for the personal data processed by this service. For any privacy question or request, email [email protected].
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Email address and password (stored only as a secure hash) | Your account, sign-in and service emails such as password resets and billing notices | Contract |
| Usage counts for your account | Allowances and your dashboard analytics | Contract |
| Name, billing address and optional VAT number, collected by Stripe | Payments, invoices and tax records | Contract; legal obligation |
| IP address, converted into a pseudonymous identifier | The free allowance without a key, and abuse protection | Legitimate interest |
| Name, email and message sent through the contact form | Replying to you | Legitimate interest |
| Error reports and server logs, without request contents, and cookie-free visit statistics | Security, fixing faults and counting visits | Legitimate interest |
| Data collected by the optional tools listed under Cookies | Site statistics and advertising | Consent |
Account and billing data are needed to use an account or paid plan. We only send service emails, not marketing.
Who we share it with
- Stripe: payments and invoices.
- Resend: sending emails.
- Google: our email inbox.
- Sentry: error reports.
- Cloudflare: website delivery, security and cookie-free visit statistics.
- Our hosting provider, with servers in the European Union.
- Google (Analytics, AdSense) and Microsoft (Clarity): only if you choose Accept all.
Some of these providers may process data outside the EU, mainly in the United States. Where they do, they rely on the safeguards the law requires, such as the EU–US Data Privacy Framework or standard contractual clauses. Donations are handled by PayPal under its own privacy policy.
How long we keep it
- Account data and usage history: while your account exists. After deletion, remaining usage records are removed within 90 days.
- Pseudonymous identifiers for requests without a key: up to 90 days.
- Copies of the emails we send: 7 days.
- Billing records: as long as tax law requires.
- Contact messages: up to 12 months.
- Server logs and error reports: up to 30 days.
Cookies
Essential cookies are always on, because the site needs them to work:
| Name | Purpose | Duration |
|---|---|---|
oe_session | Keeps you logged in | 7 days |
csrftoken | Protects forms against forgery | 1 year |
oe_cookie_consent_v2 (local storage) | Remembers your cookie choice | Until you clear it |
Optional cookies are set only if you choose Accept all. They last from one day to two years, as set by each provider:
- Google Analytics (
_ga,_gid): how the website is used. - Google AdSense (
__gads,__gpi,__eoi): advertising, which may be personalised. - Microsoft Clarity (
_clck,_clsk): how pages are used, including recordings with page contents masked.
You can change your choice at any time with Cookie settings at the bottom of the page. Choosing Essential only stops the optional tools and removes their cookies from our site. Cookies that providers keep on their own domains can be removed in your browser.
Your rights
You can ask to access, correct, delete or export your personal data, or to restrict or object to its use. Where we rely on consent, you can withdraw it at any time. To make a request, or to delete your account, email us from your account’s address. We reply within one month.
You can also complain to the Portuguese data protection authority, CNPD, or to the authority where you live.
Changes
When we change this page, we update the date at the top.